CVE-2026-8605 is a hard-coded credential flaw in ScadaBR 1.2.0 that lets an attacker sign in as admin (CVSS 9.8, critical). CISA says the vendor has not responded, so isolate the system and limit who can reach its login page. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The CISA advisory ICSA-26-139-03 lists ScadaBR 1.2.0. The weakness is CWE-798, use of hard-coded credentials. Anyone who knows the built in credentials can access the system as an administrator.
No fixed version is listed, and CISA says the vendor has not engaged on mitigation. The record is not in the CISA KEV catalog.
How to check if you're exposed
Check whether ScadaBR runs in your environment, then check how accounts are set up. Try to confirm from the ScadaBR documentation or support which accounts ship with the product, and whether you changed them. Confirm that the login page is only reachable from your control network.
What to do now
- Take the login page off any network that is not strictly needed.
- Change default administrator credentials if the product lets you, and remove unused accounts.
- Place ScadaBR behind a VPN or firewall rule that names the operator hosts.
- Review the audit trail for logins you cannot match to a person.
- Ask the vendor about a fix, and plan a replacement if none arrives.
Why it matters
A hard-coded credential is a secret that ships in every copy of the product. Once it is known, it works everywhere, and the owner cannot change it by following normal password hygiene.
The defence in this case is the network. If the login page is not reachable, the credential is of no use to an outsider.
Quick check
Can I fix this by changing my admin password?
Possibly not. A hard coded credential is built into the product, so changing your own account may not remove it. Ask the vendor and rely on network controls.
Sources
Last reviewed: 19 October 2026.
